1. 17 Jan, 2018 2 commits
    • Cong Wang's avatar
      tun: fix a memory leak for tfile->tx_array · 4df0bfc7
      Cong Wang authored
      tfile->tun could be detached before we close the tun fd,
      via tun_detach_all(), so it should not be used to check for
      tfile->tx_array.
      
      As Jason suggested, we probably have to clean it up
      unconditionally both in __tun_deatch() and tun_detach_all(),
      but this requires to check if it is initialized or not.
      Currently skb_array_cleanup() doesn't have such a check,
      so I check it in the caller and introduce a helper function,
      it is a bit ugly but we can always improve it in net-next.
      Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Fixes: 1576d986 ("tun: switch to use skb array for tx")
      Cc: Jason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4df0bfc7
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · 8cbab92d
      Linus Torvalds authored
      Pull rdma fixes from Doug Ledford:
       "We had a few more items creep up over the last week. Given we are in
        -rc8, these are obviously limited to bugs that have a big downside and
        for which we are certain of the fix.
      
        The first is a straight up oops bug that all you have to do is read
        the code to see it's a guaranteed 100% oops bug.
      
        The second is a use-after-free issue. We get away lucky if the queue
        we are shutting down is empty, but if it isn't, we can end up oopsing.
        We really need to drain the queue before destroying it.
      
        The final one is an issue with bad user input causing us to access our
        port array out of bounds. While fixing the array out of bounds issue,
        it was noticed that the original code did the same thing twice (the
        call to rdma_ah_set_port_num()), so its removal is not balanced by a
        readd elsewhere, it was already where it needed to be in addition to
        where it didn't need to be.
      
        Summary:
      
         - Oops fix in hfi1 driver
      
         - use-after-free issue in iser-target
      
         - use of user supplied array index without proper checking"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        RDMA/mlx5: Fix out-of-bound access while querying AH
        IB/hfi1: Prevent a NULL dereference
        iser-target: Fix possible use-after-free in connection establishment error
      8cbab92d
  2. 16 Jan, 2018 12 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · b45a53be
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Two read past end of buffer fixes in AF_KEY, from Eric Biggers.
      
       2) Memory leak in key_notify_policy(), from Steffen Klassert.
      
       3) Fix overflow with bpf arrays, from Daniel Borkmann.
      
       4) Fix RDMA regression with mlx5 due to mlx5 no longer using
          pci_irq_get_affinity(), from Saeed Mahameed.
      
       5) Missing RCU read locking in nl80211_send_iface() when it calls
          ieee80211_bss_get_ie(), from Dominik Brodowski.
      
       6) cfg80211 should check dev_set_name()'s return value, from Johannes
          Berg.
      
       7) Missing module license tag in 9p protocol, from Stephen Hemminger.
      
       8) Fix crash due to too small MTU in udp ipv6 sendmsg, from Mike
          Maloney.
      
       9) Fix endless loop in netlink extack code, from David Ahern.
      
      10) TLS socket layer sets inverted error codes, resulting in an endless
          loop. From Robert Hering.
      
      11) Revert openvswitch erspan tunnel support, it's mis-designed and we
          need to kill it before it goes into a real release. From William Tu.
      
      12) Fix lan78xx failures in full speed USB mode, from Yuiko Oshino.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (54 commits)
        net, sched: fix panic when updating miniq {b,q}stats
        qed: Fix potential use-after-free in qed_spq_post()
        nfp: use the correct index for link speed table
        lan78xx: Fix failure in USB Full Speed
        sctp: do not allow the v4 socket to bind a v4mapped v6 address
        sctp: return error if the asoc has been peeled off in sctp_wait_for_sndbuf
        sctp: reinit stream if stream outcnt has been change by sinit in sendmsg
        ibmvnic: Fix pending MAC address changes
        netlink: extack: avoid parenthesized string constant warning
        ipv4: Make neigh lookup keys for loopback/point-to-point devices be INADDR_ANY
        net: Allow neigh contructor functions ability to modify the primary_key
        sh_eth: fix dumping ARSTR
        Revert "openvswitch: Add erspan tunnel support."
        net/tls: Fix inverted error codes to avoid endless loop
        ipv6: ip6_make_skb() needs to clear cork.base.dst
        sctp: avoid compiler warning on implicit fallthru
        net: ipv4: Make "ip route get" match iif lo rules again.
        netlink: extack needs to be reset each time through loop
        tipc: fix a memory leak in tipc_nl_node_get_link()
        ipv6: fix udpv6 sendmsg crash caused by too small MTU
        ...
      b45a53be
    • Linus Torvalds's avatar
      Merge tag 'sound-4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 41aa5e5d
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "A few small last-minute fixes that should sneak into 4.15:
      
         - remove a spurious WARN_ON() triggered by syzkaller
      
         - fix for ioctl races in ALSA sequencer
      
         - two trivial HD-audio fixup entries"
      
      * tag 'sound-4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: seq: Make ioctls race-free
        ALSA: pcm: Remove yet superfluous WARN_ON()
        ALSA: hda - Apply the existing quirk to iMac 14,1
        ALSA: hda - Apply headphone noise quirk for another Dell XPS 13 variant
      41aa5e5d
    • Linus Torvalds's avatar
      Merge tag 'trace-v4.15-rc4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 921d4f67
      Linus Torvalds authored
      Pull tracing fixes from Steven Rostedt:
      
       - Bring back context level recursive protection in ring buffer.
      
         The simpler counter protection failed, due to a path when tracing
         with trace_clock_global() as it could not be reentrant and depended
         on the ring buffer recursive protection to keep that from happening.
      
       - Prevent branch profiling when FORTIFY_SOURCE is enabled.
      
         It causes 50 - 60 MB in warning messages. Branch profiling should
         never be run on production systems, so there's no reason that it
         needs to be enabled with FORTIFY_SOURCE.
      
      * tag 'trace-v4.15-rc4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Prevent PROFILE_ALL_BRANCHES when FORTIFY_SOURCE=y
        ring-buffer: Bring back context level recursive checks
      921d4f67
    • Daniel Borkmann's avatar
      net, sched: fix panic when updating miniq {b,q}stats · 81d947e2
      Daniel Borkmann authored
      While working on fixing another bug, I ran into the following panic
      on arm64 by simply attaching clsact qdisc, adding a filter and running
      traffic on ingress to it:
      
        [...]
        [  178.188591] Unable to handle kernel read from unreadable memory at virtual address 810fb501f000
        [  178.197314] Mem abort info:
        [  178.200121]   ESR = 0x96000004
        [  178.203168]   Exception class = DABT (current EL), IL = 32 bits
        [  178.209095]   SET = 0, FnV = 0
        [  178.212157]   EA = 0, S1PTW = 0
        [  178.215288] Data abort info:
        [  178.218175]   ISV = 0, ISS = 0x00000004
        [  178.222019]   CM = 0, WnR = 0
        [  178.224997] user pgtable: 4k pages, 48-bit VAs, pgd = 0000000023cb3f33
        [  178.231531] [0000810fb501f000] *pgd=0000000000000000
        [  178.236508] Internal error: Oops: 96000004 [#1] SMP
        [...]
        [  178.311855] CPU: 73 PID: 2497 Comm: ping Tainted: G        W        4.15.0-rc7+ #5
        [  178.319413] Hardware name: FOXCONN R2-1221R-A4/C2U4N_MB, BIOS G31FB18A 03/31/2017
        [  178.326887] pstate: 60400005 (nZCv daif +PAN -UAO)
        [  178.331685] pc : __netif_receive_skb_core+0x49c/0xac8
        [  178.336728] lr : __netif_receive_skb+0x28/0x78
        [  178.341161] sp : ffff00002344b750
        [  178.344465] x29: ffff00002344b750 x28: ffff810fbdfd0580
        [  178.349769] x27: 0000000000000000 x26: ffff000009378000
        [...]
        [  178.418715] x1 : 0000000000000054 x0 : 0000000000000000
        [  178.424020] Process ping (pid: 2497, stack limit = 0x000000009f0a3ff4)
        [  178.430537] Call trace:
        [  178.432976]  __netif_receive_skb_core+0x49c/0xac8
        [  178.437670]  __netif_receive_skb+0x28/0x78
        [  178.441757]  process_backlog+0x9c/0x160
        [  178.445584]  net_rx_action+0x2f8/0x3f0
        [...]
      
      Reason is that sch_ingress and sch_clsact are doing mini_qdisc_pair_init()
      which sets up miniq pointers to cpu_{b,q}stats from the underlying qdisc.
      Problem is that this cannot work since they are actually set up right after
      the qdisc ->init() callback in qdisc_create(), so first packet going into
      sch_handle_ingress() tries to call mini_qdisc_bstats_cpu_update() and we
      therefore panic.
      
      In order to fix this, allocation of {b,q}stats needs to happen before we
      call into ->init(). In net-next, there's already such option through commit
      d59f5ffa ("net: sched: a dflt qdisc may be used with per cpu stats").
      However, the bug needs to be fixed in net still for 4.15. Thus, include
      these bits to reduce any merge churn and reuse the static_flags field to
      set TCQ_F_CPUSTATS, and remove the allocation from qdisc_create() since
      there is no other user left. Prashant Bhole ran into the same issue but
      for net-next, thus adding him below as well as co-author. Same issue was
      also reported by Sandipan Das when using bcc.
      
      Fixes: 46209401 ("net: core: introduce mini_Qdisc and eliminate usage of tp->q for clsact fastpath")
      Reference: https://lists.iovisor.org/pipermail/iovisor-dev/2018-January/001190.htmlReported-by: default avatarSandipan Das <sandipan@linux.vnet.ibm.com>
      Co-authored-by: default avatarPrashant Bhole <bhole_prashant_q7@lab.ntt.co.jp>
      Co-authored-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      81d947e2
    • Roland Dreier's avatar
      qed: Fix potential use-after-free in qed_spq_post() · 70eeff66
      Roland Dreier authored
      We need to check if p_ent->comp_mode is QED_SPQ_MODE_EBLOCK before
      calling qed_spq_add_entry().  The test is fine is the mode is EBLOCK,
      but if it isn't then qed_spq_add_entry() might kfree(p_ent).
      Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      70eeff66
    • Jakub Kicinski's avatar
      nfp: use the correct index for link speed table · 0d9c9f0f
      Jakub Kicinski authored
      sts variable is holding link speed as well as state.  We should
      be using ls to index into ls_to_ethtool.
      
      Fixes: 265aeb51 ("nfp: add support for .get_link_ksettings()")
      Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0d9c9f0f
    • Yuiko Oshino's avatar
      lan78xx: Fix failure in USB Full Speed · a5b1379a
      Yuiko Oshino authored
      Fix initialize the uninitialized tx_qlen to an appropriate value when USB
      Full Speed is used.
      
      Fixes: 55d7de9d ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
      Signed-off-by: default avatarYuiko Oshino <yuiko.oshino@microchip.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a5b1379a
    • David S. Miller's avatar
      Merge tag 'mac80211-for-davem-2018-01-15' of... · 161f72ed
      David S. Miller authored
      Merge tag 'mac80211-for-davem-2018-01-15' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
      
      Johannes Berg says:
      
      ====================
      More fixes:
       * hwsim:
          - properly flush deletion works at module unload
          - validate # of channels passed from userspace
       * cfg80211:
          - fix RCU locking regression
          - initialize on-stack channel data for nl80211 event
          - check dev_set_name() return value
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      161f72ed
    • Xin Long's avatar
      sctp: do not allow the v4 socket to bind a v4mapped v6 address · c5006b8a
      Xin Long authored
      The check in sctp_sockaddr_af is not robust enough to forbid binding a
      v4mapped v6 addr on a v4 socket.
      
      The worse thing is that v4 socket's bind_verify would not convert this
      v4mapped v6 addr to a v4 addr. syzbot even reported a crash as the v4
      socket bound a v6 addr.
      
      This patch is to fix it by doing the common sa.sa_family check first,
      then AF_INET check for v4mapped v6 addrs.
      
      Fixes: 7dab83de ("sctp: Support ipv6only AF_INET6 sockets.")
      Reported-by: syzbot+7b7b518b1228d2743963@syzkaller.appspotmail.com
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c5006b8a
    • Xin Long's avatar
      sctp: return error if the asoc has been peeled off in sctp_wait_for_sndbuf · a0ff6600
      Xin Long authored
      After commit cea0cc80 ("sctp: use the right sk after waking up from
      wait_buf sleep"), it may change to lock another sk if the asoc has been
      peeled off in sctp_wait_for_sndbuf.
      
      However, the asoc's new sk could be already closed elsewhere, as it's in
      the sendmsg context of the old sk that can't avoid the new sk's closing.
      If the sk's last one refcnt is held by this asoc, later on after putting
      this asoc, the new sk will be freed, while under it's own lock.
      
      This patch is to revert that commit, but fix the old issue by returning
      error under the old sk's lock.
      
      Fixes: cea0cc80 ("sctp: use the right sk after waking up from wait_buf sleep")
      Reported-by: syzbot+ac6ea7baa4432811eb50@syzkaller.appspotmail.com
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a0ff6600
    • Xin Long's avatar
      sctp: reinit stream if stream outcnt has been change by sinit in sendmsg · 625637bf
      Xin Long authored
      After introducing sctp_stream structure, sctp uses stream->outcnt as the
      out stream nums instead of c.sinit_num_ostreams.
      
      However when users use sinit in cmsg, it only updates c.sinit_num_ostreams
      in sctp_sendmsg. At that moment, stream->outcnt is still using previous
      value. If it's value is not updated, the sinit_num_ostreams of sinit could
      not really work.
      
      This patch is to fix it by updating stream->outcnt and reiniting stream
      if stream outcnt has been change by sinit in sendmsg.
      
      Fixes: a8386317 ("sctp: prepare asoc stream for stream reconf")
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      625637bf
    • Thomas Falcon's avatar
      ibmvnic: Fix pending MAC address changes · 3d166130
      Thomas Falcon authored
      Due to architecture limitations, the IBM VNIC client driver is unable
      to perform MAC address changes unless the device has "logged in" to
      its backing device. Currently, pending MAC changes are handled before
      login, resulting in an error and failure to change the MAC address.
      Moving that chunk to the end of the ibmvnic_login function, when we are
      sure that it was successful, fixes that.
      
      The MAC address can be changed when the device is up or down, so
      only check if the device is in a "PROBED" state before setting the
      MAC address.
      
      Fixes: c26eba03 ("ibmvnic: Update reset infrastructure to support tunable parameters")
      Signed-off-by: default avatarThomas Falcon <tlfalcon@linux.vnet.ibm.com>
      Reviewed-by: default avatarJohn Allen <jallen@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3d166130
  3. 15 Jan, 2018 25 commits
    • Leon Romanovsky's avatar
      RDMA/mlx5: Fix out-of-bound access while querying AH · ae59c3f0
      Leon Romanovsky authored
      The rdma_ah_find_type() accesses the port array based on an index
      controlled by userspace. The existing bounds check is after the first use
      of the index, so userspace can generate an out of bounds access, as shown
      by the KASN report below.
      
      ==================================================================
      BUG: KASAN: slab-out-of-bounds in to_rdma_ah_attr+0xa8/0x3b0
      Read of size 4 at addr ffff880019ae2268 by task ibv_rc_pingpong/409
      
      CPU: 0 PID: 409 Comm: ibv_rc_pingpong Not tainted 4.15.0-rc2-00031-gb60a3faf5b83-dirty #3
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
      Call Trace:
       dump_stack+0xe9/0x18f
       print_address_description+0xa2/0x350
       kasan_report+0x3a5/0x400
       to_rdma_ah_attr+0xa8/0x3b0
       mlx5_ib_query_qp+0xd35/0x1330
       ib_query_qp+0x8a/0xb0
       ib_uverbs_query_qp+0x237/0x7f0
       ib_uverbs_write+0x617/0xd80
       __vfs_write+0xf7/0x500
       vfs_write+0x149/0x310
       SyS_write+0xca/0x190
       entry_SYSCALL_64_fastpath+0x18/0x85
      RIP: 0033:0x7fe9c7a275a0
      RSP: 002b:00007ffee5498738 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
      RAX: ffffffffffffffda RBX: 00007fe9c7ce4b00 RCX: 00007fe9c7a275a0
      RDX: 0000000000000018 RSI: 00007ffee5498800 RDI: 0000000000000003
      RBP: 000055d0c8d3f010 R08: 00007ffee5498800 R09: 0000000000000018
      R10: 00000000000000ba R11: 0000000000000246 R12: 0000000000008000
      R13: 0000000000004fb0 R14: 000055d0c8d3f050 R15: 00007ffee5498560
      
      Allocated by task 1:
       __kmalloc+0x3f9/0x430
       alloc_mad_private+0x25/0x50
       ib_mad_post_receive_mads+0x204/0xa60
       ib_mad_init_device+0xa59/0x1020
       ib_register_device+0x83a/0xbc0
       mlx5_ib_add+0x50e/0x5c0
       mlx5_add_device+0x142/0x410
       mlx5_register_interface+0x18f/0x210
       mlx5_ib_init+0x56/0x63
       do_one_initcall+0x15b/0x270
       kernel_init_freeable+0x2d8/0x3d0
       kernel_init+0x14/0x190
       ret_from_fork+0x24/0x30
      
      Freed by task 0:
      (stack is not available)
      
      The buggy address belongs to the object at ffff880019ae2000
       which belongs to the cache kmalloc-512 of size 512
      The buggy address is located 104 bytes to the right of
       512-byte region [ffff880019ae2000, ffff880019ae2200)
      The buggy address belongs to the page:
      page:000000005d674e18 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
      flags: 0x4000000000008100(slab|head)
      raw: 4000000000008100 0000000000000000 0000000000000000 00000001000c000c
      raw: dead000000000100 dead000000000200 ffff88001a402000 0000000000000000
      page dumped because: kasan: bad access detected
      
      Memory state around the buggy address:
       ffff880019ae2100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
       ffff880019ae2180: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
      >ffff880019ae2200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                                ^
       ffff880019ae2280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
       ffff880019ae2300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      ==================================================================
      Disabling lock debugging due to kernel taint
      
      Cc: <stable@vger.kernel.org>
      Fixes: 44c58487 ("IB/core: Define 'ib' and 'roce' rdma_ah_attr types")
      Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      ae59c3f0
    • Johannes Berg's avatar
      netlink: extack: avoid parenthesized string constant warning · 6311b7ce
      Johannes Berg authored
      NL_SET_ERR_MSG() and NL_SET_ERR_MSG_ATTR() lead to the following warning
      in newer versions of gcc:
        warning: array initialized from parenthesized string constant
      
      Just remove the parentheses, they're not needed in this context since
      anyway since there can be no operator precendence issues or similar.
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6311b7ce
    • David S. Miller's avatar
      Merge branch 'ipv4-Make-neigh-lookup-keys-for-loopback-point-to-point-devices-be-INADDR_ANY' · db9ca5ca
      David S. Miller authored
      Jim Westfall says:
      
      ====================
      ipv4: Make neigh lookup keys for loopback/point-to-point devices be INADDR_ANY
      
      This used to be the previous behavior in older kernels but became broken in
      a263b309 (ipv4: Make neigh lookups directly in output packet path)
      and then later removed because it was broken in 0bb4087c (ipv4: Fix neigh
      lookup keying over loopback/point-to-point devices)
      
      Not having this results in there being an arp entry for every remote ip
      address that the device talks to.  Given a fairly active device it can
      cause the arp table to become huge and/or having to add/purge large number
      of entires to keep within table size thresholds.
      
      $ ip -4 neigh show nud noarp | grep tun | wc -l
      55850
      
      $ lnstat -k arp_cache:entries,arp_cache:allocs,arp_cache:destroys -c 10
      arp_cach|arp_cach|arp_cach|
       entries|  allocs|destroys|
         81493|620166816|620126069|
        101867|   10186|       0|
        113854|    5993|       0|
        118773|    2459|       0|
         27937|   18579|   63998|
         39256|    5659|       0|
         56231|    8487|       0|
         65602|    4685|       0|
         79697|    7047|       0|
         90733|    5517|       0|
      
      v2:
       - fixes coding style issues
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      db9ca5ca
    • Jim Westfall's avatar
      ipv4: Make neigh lookup keys for loopback/point-to-point devices be INADDR_ANY · cd9ff4de
      Jim Westfall authored
      Map all lookup neigh keys to INADDR_ANY for loopback/point-to-point devices
      to avoid making an entry for every remote ip the device needs to talk to.
      
      This used the be the old behavior but became broken in a263b309
      (ipv4: Make neigh lookups directly in output packet path) and later removed
      in 0bb4087c (ipv4: Fix neigh lookup keying over loopback/point-to-point
      devices) because it was broken.
      Signed-off-by: default avatarJim Westfall <jwestfall@surrealistic.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cd9ff4de
    • Jim Westfall's avatar
      net: Allow neigh contructor functions ability to modify the primary_key · 096b9854
      Jim Westfall authored
      Use n->primary_key instead of pkey to account for the possibility that a neigh
      constructor function may have modified the primary_key value.
      Signed-off-by: default avatarJim Westfall <jwestfall@surrealistic.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      096b9854
    • Sergei Shtylyov's avatar
      sh_eth: fix dumping ARSTR · 17d0fb0c
      Sergei Shtylyov authored
      ARSTR  is always located at the start of the TSU register region, thus
      using add_reg()  instead of add_tsu_reg() in __sh_eth_get_regs() to dump it
      causes EDMR or EDSR (depending on the register layout) to be dumped instead
      of ARSTR.  Use the correct condition/macro there...
      
      Fixes: 6b4b4fea ("sh_eth: Implement ethtool register dump operations")
      Signed-off-by: default avatarSergei Shtylyov <sergei.shtylyov@cogentembedded.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      17d0fb0c
    • William Tu's avatar
      Revert "openvswitch: Add erspan tunnel support." · 95a33208
      William Tu authored
      This reverts commit ceaa001a.
      
      The OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS attr should be designed
      as a nested attribute to support all ERSPAN v1 and v2's fields.
      The current attr is a be32 supporting only one field.  Thus, this
      patch reverts it and later patch will redo it using nested attr.
      Signed-off-by: default avatarWilliam Tu <u9012063@gmail.com>
      Cc: Jiri Benc <jbenc@redhat.com>
      Cc: Pravin Shelar <pshelar@ovn.org>
      Acked-by: default avatarJiri Benc <jbenc@redhat.com>
      Acked-by: default avatarPravin B Shelar <pshelar@ovn.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      95a33208
    • r.hering@avm.de's avatar
      net/tls: Fix inverted error codes to avoid endless loop · 30be8f8d
      r.hering@avm.de authored
      sendfile() calls can hang endless with using Kernel TLS if a socket error occurs.
      Socket error codes must be inverted by Kernel TLS before returning because
      they are stored with positive sign. If returned non-inverted they are
      interpreted as number of bytes sent, causing endless looping of the
      splice mechanic behind sendfile().
      Signed-off-by: default avatarRobert Hering <r.hering@avm.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      30be8f8d
    • Eric Dumazet's avatar
      ipv6: ip6_make_skb() needs to clear cork.base.dst · 95ef498d
      Eric Dumazet authored
      In my last patch, I missed fact that cork.base.dst was not initialized
      in ip6_make_skb() :
      
      If ip6_setup_cork() returns an error, we might attempt a dst_release()
      on some random pointer.
      
      Fixes: 862c03ee ("ipv6: fix possible mem leaks in ipv6_make_skb()")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      95ef498d
    • Randy Dunlap's avatar
      tracing: Prevent PROFILE_ALL_BRANCHES when FORTIFY_SOURCE=y · 68e76e03
      Randy Dunlap authored
      I regularly get 50 MB - 60 MB files during kernel randconfig builds.
      These large files mostly contain (many repeats of; e.g., 124,594):
      
      In file included from ../include/linux/string.h:6:0,
                       from ../include/linux/uuid.h:20,
                       from ../include/linux/mod_devicetable.h:13,
                       from ../scripts/mod/devicetable-offsets.c:3:
      ../include/linux/compiler.h:64:4: warning: '______f' is static but declared in inline function 'strcpy' which is not static [enabled by default]
          ______f = {     \
          ^
      ../include/linux/compiler.h:56:23: note: in expansion of macro '__trace_if'
                             ^
      ../include/linux/string.h:425:2: note: in expansion of macro 'if'
        if (p_size == (size_t)-1 && q_size == (size_t)-1)
        ^
      
      This only happens when CONFIG_FORTIFY_SOURCE=y and
      CONFIG_PROFILE_ALL_BRANCHES=y, so prevent PROFILE_ALL_BRANCHES if
      FORTIFY_SOURCE=y.
      
      Link: http://lkml.kernel.org/r/9199446b-a141-c0c3-9678-a3f9107f2750@infradead.orgSigned-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      68e76e03
    • Marcelo Ricardo Leitner's avatar
      37f47bc9
    • Lorenzo Colitti's avatar
      net: ipv4: Make "ip route get" match iif lo rules again. · 6503a304
      Lorenzo Colitti authored
      Commit 3765d35e ("net: ipv4: Convert inet_rtm_getroute to rcu
      versions of route lookup") broke "ip route get" in the presence
      of rules that specify iif lo.
      
      Host-originated traffic always has iif lo, because
      ip_route_output_key_hash and ip6_route_output_flags set the flow
      iif to LOOPBACK_IFINDEX. Thus, putting "iif lo" in an ip rule is a
      convenient way to select only originated traffic and not forwarded
      traffic.
      
      inet_rtm_getroute used to match these rules correctly because
      even though it sets the flow iif to 0, it called
      ip_route_output_key which overwrites iif with LOOPBACK_IFINDEX.
      But now that it calls ip_route_output_key_hash_rcu, the ifindex
      will remain 0 and not match the iif lo in the rule. As a result,
      "ip route get" will return ENETUNREACH.
      
      Fixes: 3765d35e ("net: ipv4: Convert inet_rtm_getroute to rcu versions of route lookup")
      Tested: https://android.googlesource.com/kernel/tests/+/master/net/test/multinetwork_test.py passes again
      Signed-off-by: default avatarLorenzo Colitti <lorenzo@google.com>
      Acked-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6503a304
    • David Ahern's avatar
      netlink: extack needs to be reset each time through loop · cbbdf843
      David Ahern authored
      syzbot triggered the WARN_ON in netlink_ack testing the bad_attr value.
      The problem is that netlink_rcv_skb loops over the skb repeatedly invoking
      the callback and without resetting the extack leaving potentially stale
      data. Initializing each time through avoids the WARN_ON.
      
      Fixes: 2d4bc933 ("netlink: extended ACK reporting")
      Reported-by: syzbot+315fa6766d0f7c359327@syzkaller.appspotmail.com
      Signed-off-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cbbdf843
    • Cong Wang's avatar
      tipc: fix a memory leak in tipc_nl_node_get_link() · 59b36613
      Cong Wang authored
      When tipc_node_find_by_name() fails, the nlmsg is not
      freed.
      
      While on it, switch to a goto label to properly
      free it.
      
      Fixes: be9c086715c ("tipc: narrow down exposure of struct tipc_node")
      Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Cc: Jon Maloy <jon.maloy@ericsson.com>
      Cc: Ying Xue <ying.xue@windriver.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Acked-by: default avatarYing Xue <ying.xue@windriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      59b36613
    • Mike Maloney's avatar
      ipv6: fix udpv6 sendmsg crash caused by too small MTU · 749439bf
      Mike Maloney authored
      The logic in __ip6_append_data() assumes that the MTU is at least large
      enough for the headers.  A device's MTU may be adjusted after being
      added while sendmsg() is processing data, resulting in
      __ip6_append_data() seeing any MTU.  For an mtu smaller than the size of
      the fragmentation header, the math results in a negative 'maxfraglen',
      which causes problems when refragmenting any previous skb in the
      skb_write_queue, leaving it possibly malformed.
      
      Instead sendmsg returns EINVAL when the mtu is calculated to be less
      than IPV6_MIN_MTU.
      
      Found by syzkaller:
      kernel BUG at ./include/linux/skbuff.h:2064!
      invalid opcode: 0000 [#1] SMP KASAN
      Dumping ftrace buffer:
         (ftrace buffer empty)
      Modules linked in:
      CPU: 1 PID: 14216 Comm: syz-executor5 Not tainted 4.13.0-rc4+ #2
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      task: ffff8801d0b68580 task.stack: ffff8801ac6b8000
      RIP: 0010:__skb_pull include/linux/skbuff.h:2064 [inline]
      RIP: 0010:__ip6_make_skb+0x18cf/0x1f70 net/ipv6/ip6_output.c:1617
      RSP: 0018:ffff8801ac6bf570 EFLAGS: 00010216
      RAX: 0000000000010000 RBX: 0000000000000028 RCX: ffffc90003cce000
      RDX: 00000000000001b8 RSI: ffffffff839df06f RDI: ffff8801d9478ca0
      RBP: ffff8801ac6bf780 R08: ffff8801cc3f1dbc R09: 0000000000000000
      R10: ffff8801ac6bf7a0 R11: 43cb4b7b1948a9e7 R12: ffff8801cc3f1dc8
      R13: ffff8801cc3f1d40 R14: 0000000000001036 R15: dffffc0000000000
      FS:  00007f43d740c700(0000) GS:ffff8801dc100000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007f7834984000 CR3: 00000001d79b9000 CR4: 00000000001406e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
       ip6_finish_skb include/net/ipv6.h:911 [inline]
       udp_v6_push_pending_frames+0x255/0x390 net/ipv6/udp.c:1093
       udpv6_sendmsg+0x280d/0x31a0 net/ipv6/udp.c:1363
       inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:762
       sock_sendmsg_nosec net/socket.c:633 [inline]
       sock_sendmsg+0xca/0x110 net/socket.c:643
       SYSC_sendto+0x352/0x5a0 net/socket.c:1750
       SyS_sendto+0x40/0x50 net/socket.c:1718
       entry_SYSCALL_64_fastpath+0x1f/0xbe
      RIP: 0033:0x4512e9
      RSP: 002b:00007f43d740bc08 EFLAGS: 00000216 ORIG_RAX: 000000000000002c
      RAX: ffffffffffffffda RBX: 00000000007180a8 RCX: 00000000004512e9
      RDX: 000000000000002e RSI: 0000000020d08000 RDI: 0000000000000005
      RBP: 0000000000000086 R08: 00000000209c1000 R09: 000000000000001c
      R10: 0000000000040800 R11: 0000000000000216 R12: 00000000004b9c69
      R13: 00000000ffffffff R14: 0000000000000005 R15: 00000000202c2000
      Code: 9e 01 fe e9 c5 e8 ff ff e8 7f 9e 01 fe e9 4a ea ff ff 48 89 f7 e8 52 9e 01 fe e9 aa eb ff ff e8 a8 b6 cf fd 0f 0b e8 a1 b6 cf fd <0f> 0b 49 8d 45 78 4d 8d 45 7c 48 89 85 78 fe ff ff 49 8d 85 ba
      RIP: __skb_pull include/linux/skbuff.h:2064 [inline] RSP: ffff8801ac6bf570
      RIP: __ip6_make_skb+0x18cf/0x1f70 net/ipv6/ip6_output.c:1617 RSP: ffff8801ac6bf570
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarMike Maloney <maloney@google.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      749439bf
    • Arnd Bergmann's avatar
      net: cs89x0: add MODULE_LICENSE · 6200b430
      Arnd Bergmann authored
      This driver lacks a MODULE_LICENSE tag, leading to a Kbuild warning:
      
      WARNING: modpost: missing MODULE_LICENSE() in drivers/net/ethernet/cirrus/cs89x0.o
      
      This adds license, author, and description according to the
      comment block at the start of the file.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6200b430
    • Guillaume Nault's avatar
      ppp: unlock all_ppp_mutex before registering device · 0171c418
      Guillaume Nault authored
      ppp_dev_uninit(), which is the .ndo_uninit() handler of PPP devices,
      needs to lock pn->all_ppp_mutex. Therefore we mustn't call
      register_netdevice() with pn->all_ppp_mutex already locked, or we'd
      deadlock in case register_netdevice() fails and calls .ndo_uninit().
      
      Fortunately, we can unlock pn->all_ppp_mutex before calling
      register_netdevice(). This lock protects pn->units_idr, which isn't
      used in the device registration process.
      
      However, keeping pn->all_ppp_mutex locked during device registration
      did ensure that no device in transient state would be published in
      pn->units_idr. In practice, unlocking it before calling
      register_netdevice() doesn't change this property: ppp_unit_register()
      is called with 'ppp_mutex' locked and all searches done in
      pn->units_idr hold this lock too.
      
      Fixes: 8cb775bc ("ppp: fix device unregistration upon netns deletion")
      Reported-and-tested-by: syzbot+367889b9c9e279219175@syzkaller.appspotmail.com
      Signed-off-by: default avatarGuillaume Nault <g.nault@alphalink.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0171c418
    • Michael S. Tsirkin's avatar
      ptr_ring: document usage around __ptr_ring_peek · 66940f35
      Michael S. Tsirkin authored
      This explains why is the net usage of __ptr_ring_peek
      actually ok without locks.
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      66940f35
    • Stephen Hemminger's avatar
      9p: add missing module license for xen transport · d542296a
      Stephen Hemminger authored
      The 9P of Xen module is missing required license and module information.
      See https://bugzilla.kernel.org/show_bug.cgi?id=198109Reported-by: default avatarAlan Bartlett <ajb@elrepo.org>
      Fixes: 868eb122 ("xen/9pfs: introduce Xen 9pfs transport driver")
      Signed-off-by: default avatarStephen Hemminger <stephen@networkplumber.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d542296a
    • Steven Rostedt (VMware)'s avatar
      ring-buffer: Bring back context level recursive checks · a0e3a18f
      Steven Rostedt (VMware) authored
      Commit 1a149d7d ("ring-buffer: Rewrite trace_recursive_(un)lock() to be
      simpler") replaced the context level recursion checks with a simple counter.
      This would prevent the ring buffer code from recursively calling itself more
      than the max number of contexts that exist (Normal, softirq, irq, nmi). But
      this change caused a lockup in a specific case, which was during suspend and
      resume using a global clock. Adding a stack dump to see where this occurred,
      the issue was in the trace global clock itself:
      
        trace_buffer_lock_reserve+0x1c/0x50
        __trace_graph_entry+0x2d/0x90
        trace_graph_entry+0xe8/0x200
        prepare_ftrace_return+0x69/0xc0
        ftrace_graph_caller+0x78/0xa8
        queued_spin_lock_slowpath+0x5/0x1d0
        trace_clock_global+0xb0/0xc0
        ring_buffer_lock_reserve+0xf9/0x390
      
      The function graph tracer traced queued_spin_lock_slowpath that was called
      by trace_clock_global. This pointed out that the trace_clock_global() is not
      reentrant, as it takes a spin lock. It depended on the ring buffer recursive
      lock from letting that happen.
      
      By removing the context detection and adding just a max number of allowable
      recursions, it allowed the trace_clock_global() to be entered again and try
      to retake the spinlock it already held, causing a deadlock.
      
      Fixes: 1a149d7d ("ring-buffer: Rewrite trace_recursive_(un)lock() to be simpler")
      Reported-by: default avatarDavid Weinehall <david.weinehall@gmail.com>
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      a0e3a18f
    • Johannes Berg's avatar
      cfg80211: check dev_set_name() return value · 59b179b4
      Johannes Berg authored
      syzbot reported a warning from rfkill_alloc(), and after a while
      I think that the reason is that it was doing fault injection and
      the dev_set_name() failed, leaving the name NULL, and we didn't
      check the return value and got to rfkill_alloc() with a NULL name.
      Since we really don't want a NULL name, we ought to check the
      return value.
      
      Fixes: fb28ad35 ("net: struct device - replace bus_id with dev_name(), dev_set_name()")
      Reported-by: syzbot+1ddfb3357e1d7bb5b5d3@syzkaller.appspotmail.com
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      59b179b4
    • Johannes Berg's avatar
      mac80211_hwsim: validate number of different channels · 51a1aaa6
      Johannes Berg authored
      When creating a new radio on the fly, hwsim allows this
      to be done with an arbitrary number of channels, but
      cfg80211 only supports a limited number of simultaneous
      channels, leading to a warning.
      
      Fix this by validating the number - this requires moving
      the define for the maximum out to a visible header file.
      
      Reported-by: syzbot+8dd9051ff19940290931@syzkaller.appspotmail.com
      Fixes: b59ec8dd ("mac80211_hwsim: fix number of channels in interface combinations")
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      51a1aaa6
    • Benjamin Beichler's avatar
      mac80211_hwsim: add workqueue to wait for deferred radio deletion on mod unload · b71d856a
      Benjamin Beichler authored
      When closing multiple wmediumd instances with many radios and try to
      unload the  mac80211_hwsim module, it may happen that the work items live
      longer than the module. To wait especially for this deletion work items,
      add a work queue, otherwise flush_scheduled_work would be necessary.
      Signed-off-by: default avatarBenjamin Beichler <benjamin.beichler@uni-rostock.de>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      b71d856a
    • Dominik Brodowski's avatar
      nl80211: take RCU read lock when calling ieee80211_bss_get_ie() · 7a94b8c2
      Dominik Brodowski authored
      As ieee80211_bss_get_ie() derefences an RCU to return ssid_ie, both
      the call to this function and any operation on this variable need
      protection by the RCU read lock.
      
      Fixes: 44905265 ("nl80211: don't expose wdev->ssid for most interfaces")
      Signed-off-by: default avatarDominik Brodowski <linux@dominikbrodowski.net>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      7a94b8c2
    • Johannes Berg's avatar
      cfg80211: fully initialize old channel for event · a48a52b7
      Johannes Berg authored
      Paul reported that he got a report about undefined behaviour
      that seems to me to originate in using uninitialized memory
      when the channel structure here is used in the event code in
      nl80211 later.
      
      He never reported whether this fixed it, and I wasn't able
      to trigger this so far, but we should do the right thing and
      fully initialize the on-stack structure anyway.
      Reported-by: default avatarPaul Menzel <pmenzel+linux-wireless@molgen.mpg.de>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      a48a52b7
  4. 14 Jan, 2018 1 commit